A flaw was found in rsync. An authenticated daemon peer can exploit an integer overflow vulnerability in the compressed-token decoder. By carefully manipulating the compressed-token, a malicious sender can trigger an overflow, leading to remote memory disclosure. This allows an attacker to leak sensitive process memory contents, including environment variables, passwords, and memory pointers, which significantly weakens Address Space Layout Randomization (ASLR) and can facilitate further exploitation.

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

Last updated 2 June 2026

Last updated 2 June 2026

Last updated 2 June 2026